Inherent, control and detection risk in plain terms
How inherent, control and detection risk combine into audit risk, and how the assessment changes the nature and extent of the work an audit team plans.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Every trainee learns the audit risk model in their first year and many partners stop thinking about it soon after. That is a pity, because the model is the simplest explanation of why one audit file is thick on revenue and thin on fixed assets, and why two firms auditing similar clients can rightly plan very different work.
This article puts inherent, control and detection risk in plain terms, shows how they fit together, and follows them through to the work a team plans, with a worked example for a small trading company.
Audit risk, and a note on the wording
ACCA, quoting the IAASB Glossary of Terms, defines audit risk as the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated. The glossary describes audit risk as a function of two things: the risk of material misstatement, and detection risk.
A note on versions: ACCA's article cites the IAASB Handbook of 2009 and does not refer to ISA 315 (Revised 2019), which applies to audits of periods beginning on or after December 15, 2021. The ideas below remain useful, but check the current wording of ISA 200 and ISA 315 (Revised 2019) before you quote a definition in a methodology or a file. Our article on risk assessment under ISA 315 covers the revised standard itself.
The client's side: inherent risk and control risk
The risk of material misstatement belongs to the client. The auditor assesses it but does not create or control it. ACCA's article breaks it into two parts.
Inherent risk is the susceptibility of an assertion about a class of transactions, account balance or disclosure to a misstatement that could be material, individually or in aggregate, before considering any related controls. Put simply: how likely is this figure to be wrong if nobody checked it? Estimates, complex calculations, cash, related party transactions and unusual one-off deals score high. Routine, high-volume, simple transactions score lower.
Control risk is the risk that a material misstatement in such an assertion will not be prevented, or detected and corrected, on a timely basis by the entity's internal control. Put simply: if it did go wrong, would the client's own checks catch it? A business with a one-person finance function and no review scores high almost everywhere.
Detection risk: the auditor's part
Detection risk is the one the auditor controls. ACCA describes it as the risk that the auditor's procedures, designed to reduce audit risk to an acceptably low level, will not detect a misstatement that exists and could be material.
Since the firm wants overall audit risk to stay acceptably low, the relationship is inverse. Where the risk of material misstatement is high, the auditor must accept only a low detection risk, which means doing more, and more searching, work. Where it is low, a higher detection risk is tolerable and the work can be lighter.
Why higher risk means more, and more persuasive, evidence
ACCA explains that ISA 330 indicates that, in general, the extent of audit procedures increases as the risk of material misstatement increases. The IAASB says the ISA 315 (Revised 2019) risk assessment requirements are meant to support more focused responses under ISA 330.
In practice, a higher assessed risk changes the work in three ways:
| Lever | Lower risk | Higher risk |
|---|---|---|
| Nature | Analytical review, inquiry, tests of controls | Inspection of external documents, confirmations, recalculation |
| Timing | Interim work rolled forward | Work at or near year end |
| Extent | Smaller samples | Larger samples, or all items |
The model's real value is that it forces the plan to follow the risk rather than last year's file.
Grouping by risk and scoring populations in Achekam
Achekam keeps each engagement's working papers in a Working Paper Control Centre that shows the file as an index with progress by status. The same papers can be grouped by preparer, reviewer, risk or statement line, so a reviewer can look at the file the way the risk model does: high-risk areas first, and how far along each one is.
Materiality, which sets the threshold the model works to, is proposed by staff from a benchmark with a written rationale; Achekam suggests no percentage, and the engagement partner approves, never the preparer. In Audit Intelligence, Achekam risk-scores a loaded population and proposes a sample, using random, systematic, monetary unit, specific items or all items. A reviewer who did not prepare the plan approves it before it is drawn, and no sample size is proposed without approved materiality and a confidence level. The scoring helps direct effort within a population; the assessment of risk for each assertion is still the team's judgement.
A worked example: a small trading company
A family company imports and sells hardware. It has one bookkeeper, the owner signs all payments, and inventory is the largest asset.
Inventory valuation. Inherent risk is high: many lines, some slow-moving, prices that change. Control risk is high: no one reviews the costing, and counts are informal. Detection risk must therefore be low. The team plans to attend the year-end count, test cost to supplier invoices for a larger sample, and examine sales after year end for net realisable value.
Payroll. Inherent risk is low: a handful of salaried staff, no commissions. The owner reviews the payroll each month and signs the payment, which the team tests. Detection risk can be higher: analytical review of monthly payroll against headcount, plus a small sample agreed to contracts.
Revenue. Inherent risk is moderate, but the owner's bonus depends on profit, which raises fraud risk. The team plans cut-off testing around year end and reviews journals posted to revenue after the period closed.
Each conclusion moves the work. That is the model doing its job. Our guide to linking risks to procedures shows how to record that link on file.
ACCA's technical article on audit risk explains each component in more depth, with examples of how they interact.
At your next planning meeting, ask the team to name, for each significant area, which of the three risks is driving the plan. If nobody can, the plan probably came from last year's file.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
